feat: enforce device-bound connect challenge

src/gateway/device-auth.ts

@@ -6,13 +6,16 @@ export type DeviceAuthPayloadParams = {
   scopes: string[];
   signedAtMs: number;
   token?: string | null;
+  nonce?: string | null;
+  version?: "v1" | "v2";
 };
 
 export function buildDeviceAuthPayload(params: DeviceAuthPayloadParams): string {
+  const version = params.version ?? (params.nonce ? "v2" : "v1");
   const scopes = params.scopes.join(",");
   const token = params.token ?? "";
-  return [
-    "v1",
+  const base = [
+    version,
     params.deviceId,
     params.clientId,
     params.clientMode,
@@ -20,5 +23,9 @@ export function buildDeviceAuthPayload(params: DeviceAuthPayloadParams): string
     scopes,
     String(params.signedAtMs),
     token,
-  ].join("|");
+  ];
+  if (version === "v2") {
+    base.push(params.nonce ?? "");
+  }
+  return base.join("|");
 }